Security readout for executives and security teams
Plain-English summary
A Linux OCFS2 quota error path can free filesystem quota state while scheduled work is still active. That race may corrupt kernel memory, potentially affecting confidentiality, integrity, or availability. The supplied CVSS score is 7.8, but exposure depends on using OCFS2 global quotas and reaching the affected error path.
Executive priority
Prioritize systems using OCFS2 global quotas, especially multi-user or sensitive clustered storage. Patch through normal emergency kernel procedures after compatibility testing. Systems not using OCFS2 have substantially lower likely exposure, but inventory evidence should support that conclusion.
Technical view
After ocfs2_global_read_info() schedules dqi_sync_work, a later read failure can free oinfo without first cancelling that delayed work. The worker may then access released kernel memory. The referenced kernel fix cancels the work before cleanup and preserves the read_file_info() error status.
Likely exposure
Likely limited to Linux systems running an affected kernel with OCFS2 and global quota handling in use. The supplied record lists affected versions from 2.6.29 through several stable releases, including 6.12, but does not provide reliable fixed-version boundaries.
Exploitation context
The CVSS vector describes local, low-privilege exploitation without user interaction. However, the source bundle provides no proof of practical exploitation, public weaponization, or active attacks, and the CVE is not listed as KEV.
Researcher notes
The supplied description demonstrates an active delayed-work object surviving into oinfo cleanup, consistent with a potential use-after-free condition. Debug-object warnings establish faulty lifecycle handling, not exploitability. Exact triggering conditions, affected configuration boundaries, and fixed package versions require vendor-specific confirmation.
Mitigation direction
- Identify systems running OCFS2 and determine whether global quotas are enabled.
- Map installed kernel packages against vendor advisories for CVE-2024-49966.
- Apply a vendor-supported kernel containing the referenced upstream fix.
- Reboot affected systems when required to activate the updated kernel.
- Consult vendor guidance for temporary controls if immediate kernel updates are unavailable.
Validation and detection
- Confirm the running kernel, not only the installed package, includes the fix.
- Verify vendor changelogs reference CVE-2024-49966 or the applicable stable-kernel commit.
- Review kernel logs for active-object warnings involving qsync_work_fn or OCFS2 quota initialization.
- Test OCFS2 quota initialization and failure handling in a controlled non-production environment.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2024-49966 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9LinuxVulnerability scoring details
Base CVSS 3.1 score
7.8HighVector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/fc5cc716dfbdc5fd5f373ff3b51358174cf88bfcCVE reference, Linux
- https://git.kernel.org/stable/c/89043e7ed63c7fc141e68ea5a79758ed24b6c699CVE reference, Linux
- https://git.kernel.org/stable/c/14114d8148db07e7946fb06b56a50cfa425e26c7CVE reference, Linux
- https://git.kernel.org/stable/c/4173d1277c00baeedaaca76783e98b8fd0e3c08dCVE reference, Linux
- https://git.kernel.org/stable/c/bbf41277df8b33fbedf4750a9300c147e8f104ebCVE reference, Linux
- https://git.kernel.org/stable/c/ef768020366f47d23f39c4f57bcb03af6d1e24b3CVE reference, Linux
- https://git.kernel.org/stable/c/a4346c04d055bf7e184c18a73dbd23b6a9811118CVE reference, Linux
- https://git.kernel.org/stable/c/0d707a33c84b371cb66120e198eed3374726ddd8CVE reference, Linux
- https://git.kernel.org/stable/c/35fccce29feb3706f649726d410122dd81b92c18CVE reference, Linux
- https://lists.debian.org/debian-lts-announce/2025/03/msg00002.htmlCVE reference, CVE
- https://lists.debian.org/debian-lts-announce/2025/01/msg00001.htmlCVE reference, CVE
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.